News for hackers. Stuff that matters.
Re:Bluetooth 5 by sangnoir on Wednesday June 08, 2016 @06:11AM (#11861180)
> We are all constantly surrounded by devices which are screaming data about themselves everywhere they go.

Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSID" is a WiFi AP security feature (it's not). If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @07:31AM (#11861487)
Perhaps you would like to explain what the problem with this is? Broadcasting presence in itself is not a security hole - unless you think "Do not broadcast SSID" is a WiFi AP security feature (it's not). If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

Well, there are a couple of reasons I think this is different:

1. APs are static and not mobile, versus Bluetooth devices – which can move, and are more importantly personally associated with a person. That inherently provides opportunities for more leakage on information, since device addresses can now be used to track people.

2. Devices aren't just advertising their existence. They're also advertising their services, and in some cases actually just sending whatever data a client asks for. There's a particular brand of iPad stylus which seems to just open up and send it's accelerometer readings to any device which connects. There seem to be heart-rate monitors that do the same.

For me, it's much more worrying that devices happily broadcast personal information without authentication – I don't actually think device advertisement is a big deal in comparison!

Re:Bluetooth 5 by secfirstmd on Wednesday June 08, 2016 @10:37AM (#11862533)
Agreed. Checking for Bluetooth devices in the immediate area is one trick we teach in our physical counter-surveillance training for NGOs and journalists in high risk countries.
Re:Bluetooth 5 by digi_owl on Wednesday June 08, 2016 @02:32PM (#11864425)
The basic problem with 2, is that until nfc became commonplace doing pairing was either by pin not at all. So many devices still accept 0000 or 1234 because they have so way to input a pin, and is too old to use nfc pairing.
Re:Bluetooth 5 by matthewmacleod on Wednesday June 08, 2016 @02:37PM (#11864478)
Even then, quite a lot of Bluetooth LE devices don't have support for authentication as such. How to you authenticate a connection to a heart monitor, for example? It doesn't have any buttons!
Re:Bluetooth 5 by hueving on Wednesday June 08, 2016 @06:47AM (#11861310)
>If WiFi can be secured (with devices that "scream data about themselves"), why would Bluetooth be any different?

I suspect the GP is just referring to the stuff they happen to be transmitting in the clear right now because they weren't thinking about the risks. Basically like early days 802.11 when you needed to pay big money for something like wireshark.

Re:Bluetooth 5 by sundvor on Wednesday June 08, 2016 @08:02AM (#11861594)
I feel it's an Orwellian privacy issue. If you capture Bluetooth signatures in myriad places, you should be able to track where people are going with relative ease. Increasing the range without adding security features (if that's the case) would do nothing to ameliorate such concerns.
Re:Bluetooth 5 by 0x6c6f6c on Wednesday June 08, 2016 @02:30PM (#11864406)
The tracking capability of Bluetooth is nothing next to GPS and cellular triangulation though. In an Orwellian sense, Bluetooth is not the largest threat in a mobile device.
Re:Bluetooth 5 by Kadin on Wednesday June 08, 2016 @02:55PM (#11864631)
A GPS receiver doesn't broadcast, and cellular triangulation is only possible if you control the cellular infrastructure (meaning either you are a government-level adversary or you have a set of Stingray-type devices). That's a fairly high bar.

You could track people around a fairly good area, like a shopping mall, using off-the-shelf, inexpensive Bluetooth hardware and just keeping track of where various IDs turn up. Indoors, that's probably much more accurate tracking than you could perform using cellular triangulation. It's more like the kind of tracking you do using RFID tokens in a warehouse.

I don't know if it's a problem per se, but it's something people should be aware of; many devices are constantly broadcasting a unique identifier almost all the time unless they take steps to turn it off.

Re:Bluetooth 5 by sangnoir on Thursday June 09, 2016 @06:20PM (#11872810)
> I don't know if it's a problem per se, but it's something people should be aware of; many devices are constantly broadcasting a unique identifier almost all the time unless they take steps to turn it off.

I can't tell whether you're referring to Bluetooth, WiFi, or both. WiFi is worse (longer range) and I suspect more widely used and likely to be left on on phones.

Re:Bluetooth 5 by wastedhours on Wednesday June 08, 2016 @06:52AM (#11861327)
OP doesn't seem to insinuate any problem with being surrounded by devices screaming data about themselves though?